CVE-2022-4656: fallo de gravedad media en WP Visitor Statistics (Real Time Traffic)
WP Visitor Statistics (Real Time Traffic) < 6.5 - Contributor+ Stored XSS via Shortcode
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4epss 0.5%
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.5 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
Unknown · WP Visitor Statistics (Real Time Traffic)CVEs relacionadas — WP Visitor Statistics (Real Time Traffic)
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-24750—WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL InjectionEPSS 38.3%CVE-2023-0600CRITICALWP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLiEPSS 4.2%CVE-2022-0410—WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL InjectionEPSS 1.3%CVE-2021-25042—WP Visitor Statistics (Real Time Traffic) < 5.5 - Arbitrary IP Address Exclusion to Stored XSSEPSS 0.5%CVE-2026-117571HIGHWP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device ParametersEPSS 0.3%CVE-2026-117572MEDIUMWP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' ParameterEPSS 0.2%